package com.atguigu2;/**
 * @auther user
 * @date 2021/12/6 - 0:30
 */

import org.junit.Test;

import java.io.InputStream;
import java.lang.reflect.Field;
import java.sql.*;
import java.util.Properties;
import java.util.Scanner;

/**
 * @Description Statement的弊端测试
 *                  1 拼接字符串
 *                  2 Sql注入
 * @createTime 2021/12/6 0:30
 * @author user
 */
public class StatementTest {
    public static void main(String[] args) {
        StatementTest statementTest = new StatementTest();

        Scanner scanner = new Scanner(System.in);
        System.out.println("请输入用户名：");
        String user = scanner.nextLine();//scanner.next(); 有换行或空格就表示输入结束，nextLine()以换行为结束标志
        //在 Junit 下, 想读取用户输入,一直卡住，无法输入
        //改为在 main 方法中执行, 接收正常.
        //解决办法: 增加 idea 配置, 重启 idea 即可
        //help > edit custom vm options > 末尾增加一行
        // -Deditable.java.test.console=true
        //重启idea
        System.out.println("请输入密码：");
        String password = scanner.nextLine();
        //sql
        String sql = "select user,password from user_table where user = '"+user+"' and password = '"+password+"'";
        //sql1
        String sql1 = "select user,password from user_table where user = '1' or ' and password = ' = '1' or '1' = '1' ";
        User userBean = statementTest.get(sql1,User.class);
        if (userBean != null) {
            System.out.println("登录成功");
            System.out.println(userBean);
        }else {
            System.out.println("用户名或密码错误");
        }
    }
    @Test
    public void testLogin(){
        Scanner scanner = new Scanner(System.in);
        System.out.println("请输入用户名：");
        String user = scanner.nextLine();//scanner.next(); 有换行或空格就表示输入结束，nextLine()以换行为结束标志
        //在 Junit 下, 想读取用户输入,一直卡住，无法输入
        //改为在 main 方法中执行, 接收正常.
        //解决办法: 增加 idea 配置, 重启 idea 即可
        //help > edit custom vm options > 末尾增加一行
        // -Deditable.java.test.console=true
        //重启idea
        System.out.println("请输入密码：");
        String password = scanner.nextLine();
        //sql
        String sql = "select user,password from user_table where user = '"+user+"' and password = '"+password+"'";
        //sql1
        String sql1 = "select user,password from user_table where user = '1' or ' and password = ' = '1' or '1' = '1' ";
        User userBean = get(sql,User.class);
        if (userBean != null) {
            System.out.println("登录成功");
            System.out.println(userBean);
        }else {
            System.out.println("用户名或密码错误");
        }
    }
    //使用Statement实现对数据表的查询操作
    public <T> T get(String sql,Class<T> clazz){
        T t = null;
        Connection connection = null;
        Statement statement = null;
        ResultSet resultSet = null;
        try {
            //1 加载配置文件
            InputStream inputStream = ClassLoader.getSystemClassLoader().getResourceAsStream("jdbc.properties");
            Properties properties = new Properties();
            properties.load(inputStream);
            //2 读取配置信息
            String user = properties.getProperty("user");
            String password = properties.getProperty("password");
            String url = properties.getProperty("url");
            String driverClass = properties.getProperty("driverClass");
            //3 加载驱动
            Class.forName(driverClass);
            //4 获取连接
            connection = DriverManager.getConnection(url, user, password);
            statement = connection.createStatement();
            resultSet = statement.executeQuery(sql);
            //获取结果集元数据
            ResultSetMetaData metaData = resultSet.getMetaData();
            //获取结果集列数
            int columnCount = metaData.getColumnCount();
            //5 处理结果集
            if (resultSet.next()){
                t = clazz.newInstance();
                for (int i = 0; i < columnCount; i++) {
                    //获取列的名称
                    //String columnName = metaData.getColumnName(i + 1);
                    //获取列的别名，没有别名，就取列名。适用于javaBean和数据库列名不一致的情况
                    String columnLabel = metaData.getColumnLabel(i + 1);
                    //根据列名获取对应的value值
                    Object columnValue = resultSet.getObject(columnLabel);
                    //将表中数据封装进对象
                        //根据别名，获取属性
                    Field field = clazz.getDeclaredField(columnLabel);
                    field.setAccessible(true);
                    field.set(t,columnValue);
                }
                return t;
            }
        } catch (Exception e) {
            e.printStackTrace();
        }finally {
            //资源关闭
            if (resultSet != null){
                try {
                    resultSet.close();
                } catch (SQLException e) {
                    e.printStackTrace();
                }
            }
            if (statement != null){
                try {
                    statement.close();
                } catch (SQLException e) {
                    e.printStackTrace();
                }
            }
            if (connection != null){
                try {
                    connection.close();
                } catch (SQLException e) {
                    e.printStackTrace();
                }
            }
        }



        return null;
    }
}
